Papra HTTP redirect bypass can lead to SSRF via webhook delivery system

Description

Papra’s webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations.

Recommendation

Update the @papra/webhooks package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.3
• Patched version(s): 0.3.3

References

• GHSA-5g86-85rp-f9hx
• CVE-2026-48051
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader - CVE-2026-27795
• Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox - CVE-2026-41270
• @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
• Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@papra/webhooks